CVE-2026-0504 LOW

CVE-2026-0504: Insufficient Input Handling in JNDI Operations of SAP Identity Management

Vendor Sap_Se
Product SAP Identity Management
Weakness CWE-943
Published January 13, 2026
Last update January 13, 2026

CVSS base score

3.8/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

Due to insufficient input handling, the SAP Identity Management REST interface allows an authenticated administrator to submit specially crafted malicious REST requests that are processed by JNDI operations without adequate input neutralization. This may lead to limited disclosure or modification of data, resulting in low impact on confidentiality and integrity, with no impact on application availability.

Key dates

02Disclosure timeline

January 13, 2026 CVE published
January 13, 2026 Record updated

Related vulnerabilities

04Related CVE